To: 


Of: 


İCO. 


Information Commissioner's Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


EB Associates Group Limited 


585a Fulham Road, 
London 
SW6 5UA 


The Information Commissioner (“the Commissioner”) has decided to 
issue EB Associates Group Limited (“EBAG”) with a monetary penalty 
under section 55A of the Data Protection Act 1998 (“DPA”). The penalty 
is in relation to a serious contravention of regulation 21B of the Privacy 


and Electronic Communications (EC Directive) Regulations 2003. 


This notice explains the Commissioner's decision. 


Legal framework 


EBAG, whose registered office is given above (Companies House 
Registration Number: 08093318) is the organisation stated in this 
notice to have instigated the use of a public electronic communications 
service for the purpose of making unsolicited calls for the purposes of 
direct marketing in relation to occupational pension schemes or 


personal pension schemes contrary to regulation 21B of PECR. 
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Regulation 21B paragraph (1) of PECR provides that: 


"(1) A person must not use, or instigate the use of, a public electronic 


communications service to make unsolicited calls to an individual 


for the purpose of direct marketing in relation to occupational 


pension schemes or personal pension schemes, except where 


paragraph (2) or (3) applies.” 


Regulation 21B paragraphs (2), (3), and (4) provide that: 


"(2) This paragraph applies where— 


(a) 


(b) 


the caller is an authorised person or a person who is the 
trustee or manager of an occupational pension scheme or a 


personal pension scheme; and 


the called line is that of an individual who has previously 
notified the caller that for the time being the individual 
consents to such calls being made by the caller on that 


line. 


(3) This paragraph applies where— 


(a) 


(b) 


the caller is an authorised person or a person who is the 
trustee or manager of an occupational pension scheme or a 


personal pension scheme; 


the recipient of the call has an existing client relationship 
with the caller on the line and the relationship is such that 
the recipient might reasonably envisage receiving 
unsolicited calls for the purpose of direct marketing in 
relation to occupational pension schemes or personal 


pension schemes; and 
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(c) the recipient of the call has been given a simple means of 


refusing (free of charge except for the costs of the 


transmission of the refusal) the use of the recipient's 


contact details for the purpose of such direct marketing, at 


the time that the details were initially collected and, where 


the recipient did not initially refuse the use of the details, 


at the time of each subsequent communication. 


(4) A subscriber must not permit the subscriber's line to be used in 


contravention of paragraph (1)”. 


6. Regulation 21B paragraph 5 materially states that: 


"(5) In this regulation— 


(a) “authorised person” has the meaning given in section 31 of 
the Financial Services and Markets Act 2000; 


(b) “direct marketing in relation to occupational pension 


schemes or personal pension schemes” includes— 


(i) 


(ii) 


(iii) 


the marketing of a product or service to be 
acquired using funds held, or previously held, 
in an occupational pension scheme or a 


personal pension scheme, 


the offer of any advice or other service that 
promotes, or promotes the consideration of, 
the withdrawal or transfer of funds from an 
occupational pension scheme or a personal 


pension scheme, and 


the offer of any advice or other service to 


enable the assessment of the performance of 
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an occupational pension scheme or a personal 


pension scheme (including its performance in 


comparison with other forms of investment); 


(c) “existing client relationship” does not include a relationship 
established at the instigation of the caller primarily for the 


purpose of avoiding the restriction in paragraph (1); and 


(d) “occupational pension scheme” and “personal pension 
scheme” have the meanings given in section 1(1) of the 


Pension Schemes Act 1993.” 


Section 122(5) of the Data Protection Act 2018 (“DPA18”) defines 
direct marketing as “the communication (by whatever means) of 
advertising or marketing material which is directed to particular 
individuals”. This definition also applies for the purposes of PECR (see 
regulation 2(2) PECR and paragraphs 430 & 432(6) to Schedule 19 of 
the DPA18). 


Prior to 29 March 2019, the European Directive 95/46/EC defined 
‘consent’ as “any freely given specific and informed indication of his 
wishes by which the data subject signifies his agreement to personal 


data relating to him being processed”. 


From 29 March 2019 until 1 January 2021, consent in PECR was 
defined by reference to the concept of consent in Regulation 2016/679 
(“the GDPR”): regulation 8(2) of the Data Protection, Privacy and 
Electronic Communications (Amendments etc) (EU Exit) Regulations 
2019. Article 4(11) of the GDPR sets out the following definition: 
“‘consent’ of the data subject means any freely given, specific, 
informed and unambiguous indication of the data subject's wishes by 


which he or she, by a statement or by a clear affirmative action, 
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signifies agreement to the processing of personal data relating to him 


or her”. 


Recital 32 of the GDPR materially states that “When the processing has 
multiple purposes, consent should be given for all of them”. Recital 42 
materially provides that “For consent to be informed, the data subject 
should be aware at least of the identity of the controller”. Recital 43 
materially states that “Consent is presumed not to be freely given if it 
does not allow separate consent to be given to different personal data 
processing operations despite it being appropriate in the individual 


case”. 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 


A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


Section 55A of the DPA (as applied to PECR cases by Schedule 1 to 


PECR, as variously amended) states: 


"(1) The Commissioner may serve a person with a monetary penalty if 
the Commissioner is satisfied that - 


(a) there has been a serious contravention of the requirements 
of the Privacy and Electronic Communications (EC 


Directive) Regulations 2003 by the person, 
(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 


(3) This subsection applies if the person - 
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(a) knew or ought to have known that there was a risk that 
the contravention would occur, but 


(b) failed to take reasonable steps to prevent the 


contravention.” 


The Commissioner has issued statutory guidance under section 55C (1) 
of the DPA about the issuing of monetary penalties that has been 
published on the ICO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR were enacted to protect the individual's fundamental right to 
privacy in the electronic communications sector. PECR were 
subsequently amended and strengthened. The Commissioner will 
interpret PECR in a way which is consistent with the Regulations’ 
overall aim of ensuring high levels of protection for individuals’ privacy 


rights. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the DPA18: see paragraph 58(1) of 
Schedule 20 to the DPA18. 


Background to the case 


EBAG first came to the attention of the Commissioner during a wider 
investigation into organisations which appeared to be making 
unsolicited direct marketing calls to individuals regarding pension 


schemes. 
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During this wider investigation the Commissioner became aware of an 
organisation which would engage in such unsolicited calls to individuals 


and would relay the data of any individuals who agreed to a pension 


review on to EBAG. 


Noting that these calls appeared to be carried out at the instigation of 
EBAG, the Commissioner sent an initial investigation letter to EBAG on 
26 September 2019 to highlight her concerns that there may be issues 
with EBAG’s compliance with PECR and to request further information 


in relation to its marketing activity. 


A response was received on 7 October 2019 which advised that it had 
contracts in place with two Introducer Appointed Representatives 
(“IARs”) who introduce to it individuals who are looking for a financial 
review!. EBAG expressed the view that it “does not make any 
unsolicited marketing calls or carry out any marketing activities”; the 
first contact it has with an individual is to confirm or attend a pre- 
arranged review meeting. It also explained that it conducts due 


diligence on the data it receives to ensure compliance with PECR. 


The Commissioner asked for further information on 7 October 2019 
relating to the client referral process, due diligence checks and 
confirmation of all of EBAG’s IARs. 


EBAG responded on 14 October 2019 claiming that “none of the 
Appointed Representatives make calls on behalf of EB Associates Group 
Limited. Any calls made by IAR firms are made as an individual 
business entity and only once an interest in a financial review has been 
established would EB Associates Group Limited be introduced, when 


arranging a face to face meeting”. 
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EBAG further provided details of its purported due diligence checks on 
its IARs. These checks, provided in ‘.docx’ format, appeared somewhat 
limited to publicly available (i.e. ‘Companies House’) details regarding 
the company/director, and details of where the IAR may obtain ‘opt in’ 
data. There is no reference to any due diligence conducted on the data 
provided to EBAG. The metadata of each document shows that they 
were created on 14 October 2019, i.e., shortly before being sent to the 


Commissioner. 


The Commissioner subsequently requested details of any “incentives” 
that EBAG would provide to its IARs for passing data on to it; and 


details of a typical individual’s ‘customer journey’. 


EBAG responded to this request on 24 October 2019 and provided 
details of the customer journey. It explained that the first step is for an 
initial verification call to be made (by the IAR) to an individual to obtain 
a “robust opt in” prior to determining whether they are eligible for 
advice (from EBAG). If an individual is eligible, a meeting is arranged 


with a representative from EBAG. 


In respect of any incentives, EBAG explained that the IARs (referred to 
also as ‘introducers’) are “paid a fixed fee of between £300 - £750 fora 


referral”. 


EBAG also explained that its IARs would obtain its data from two 


sources: would obtain data from B, and would obtain 
data from a. 


On 25 October 2019 the Commissioner requested details of any due 
diligence checks completed on the data received from its IARs, 
together with copies of any call scripts which the IARs use when 


engaging on campaigns for EBAG. The Commissioner also wished to 
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understand how consent was obtained for the initial calls made by the 
IARs. 


EBAG’s response of 29 October 2019 explained that the IARs conduct 
their own due diligence on the data suppliers (from whom they obtain 
the data to be used in the campaigns) and that copies of the due 


diligence checks are sent to EBAG. 


EBAG explained that “/a/n assessment of the privacy notice is 
conducted to ensure the correct company name is listed and clients can 
reasonably be expected to understand that they are consenting to be 
called from the company in question”. It was further stated that IARs 
“are under contract not to amend their data source and are under 
obligation to conduct full due diligence on their data supplier and adopt 


full responsibility for this”. 


EBAG confirmed that it does not provide call scripts to its IARs. 


An ‘end of investigation’ letter was sent to EBAG on 15 July 2020. 


Despite EBAG’s reference to there being contracts between itself and 
its two IARs, no such contracts were provided during the course of the 


Commissioner’s investigation. 


The Commissioner’s investigations into the two IARs engaged at 
various points by EBAG over the period of 11 January 2019 and 30 
September 2019 revealed that a total of 107,003 connected calls were 
made by the IARs. The Commissioner is satisfied that the calls made 
by the IARs over this period were all made in relation to occupational 
pension schemes or personal pension schemes as defined at Regulation 
21B(5) PECR and were all made at EBAG’s instigation, with a view to 


referring any leads on to EBAG. 
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The Commissioner has reviewed the websites which were understood 
to have been used by the IARs’ data suppliers. It is from these 
websites that the data suppliers obtained the data which would be used 


by the IARs for the purposes of making unsolicited direct marketing 


calls offering EBAG’s services. 


BM used the following websites: 


——— ees - This website describes itself as o 
ee. It appears that users are unable to 


proceed with this site without providing consent. There is no evidence 
that either J or EBAG were listed as a third party on the site at the 


time data was obtained. 


ee e - 
Agreement to providing consent appears to be a condition of use of 
these sites. Furthermore, the communication methods and third-party 
companies are all bundled together so an individual cannot choose how 


they wish to be contacted and by which organisations. 


a used the following websites: 


ee anc 
ee A!) three consent statements appeared 


identical, and whilst they did ask for consent for postal, email and 
telephone marketing, there was no way for an individual to choose 
whether to opt in to third party marketing separately. Instead, it 
appeared that the consent statement makes it clear that an individual 
would have their details shared with selected third parties. There is a 
link to an opt out page however this was not specific and did not allow 
an individual to make an informed decision about which organisations 


they wished to receive marketing from. 
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The Commissioner has made the above findings of fact on the 


balance of probabilities. 


The Commissioner has considered whether those facts constitute a 
contravention of regulation 21B PECR by EBAG and, if so, whether the 


conditions of section 55A DPA are satisfied. 
The contravention 


The Commissioner finds that EBAG has contravened regulation 21B of 
PECR. 


The Commissioner finds that the contravention was as follows: 


The Privacy and Electronic Communications (Amendment) (No. 2) 
Regulations 2018, which came into force on 9 January 2019, amended 
PECR to insert Regulation 21B which restricts calls made for the 
purposes of direct marketing in relation to occupational pension 


schemes or personal pension schemes. 


The Commissioner is satisfied that EBAG positively encouraged its IARs 
to make calls on its behalf as evidenced by them being paid a fixed fee 
of between £300.00 and £750.00 for each referral made to it. The 
marketing campaign was initiated by EBAG; [i anc I were 
commissioned by EBAG to engage in direct marketing in order to 
generate leads. The very fact that EBAG conducted (on its case) some 
due diligence on the IARs and insisted on high standards of regulatory 
compliance shows that it was consciously engaging the IARs to carry 
out direct marketing - this is also borne out by EBAG’s disclosed 
communications with and ies expressly about direct marketing 
and the (then impending) cold-calling ban. Accordingly, the 
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Commissioner takes the view that the calls made by the IARs over the 


period of contravention were made at the instigation of EBAG. 


The calls instigated by EBAG constitute ‘direct marketing in relation to 
occupational pension schemes or personal pension schemes’ within the 
definition of regulation 21B(5)(b)[iii] PECR. Specifically, Regulation 
21B(5)(b)[iii] includes “the offer of any advice or other service to 
enable the assessment of the performance of an occupational pension 
scheme or a personal pension scheme (including its performance in 


comparison with other forms of investment)”. 


To engage in such calls it is a requirement of regulation 21B PECR that 
the caller be an ‘authorised person or a person who is the trustee or 
manager of an occupational pension scheme or a personal pension 


scheme’. 


Regulation 21B(5)(a) PECR states that “authorised person” has the 
meaning given in Section 31 of the Financial Services and Markets Act 
2000 (“FSMA”). Section 31(1) FSMA lists the categories of persons 


who would constitute “authorised persons”. 


The calls carried out on EBAG’s behalf were carried out by IARs which 
are not included in the list of categories of ‘authorised persons’ at 
Section 31(1) FSMA.. 


However, the Commissioner accepts that EBAG would meet the 
necessary criteria to be considered an ‘authorised person’ as defined by 
section 31(1) FSMA, and that in the circumstances, whilst it instigated 
calls to be carried out by non-authorised entities, it would be capable 
of satisfying the requirement of Regulation 21B(2)(a) and/or 
21B(3)(a). 
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52. The Commissioner is not however satisfied that EBAG or the IARs 
making the calls had the valid consent of those who were called, or 
that they had an existing customer relationship with them, as required 
by regulation 21B(2)(b) and 21B(3)(b). 


53. During the course of the Commissioner's parallel investigations into 
EBAG’s IARs it was discovered that wouid obtain data from BE - 
matching the information provided by EBAG - which used three sites to 
collect the data used for its calls: o e 
Ooo anc EE The investigation 
into [ discovered that it too obtained data via websites, specifically: 
SS es 2 
PY The Commissioner notes a discrepancy 


in that EBAG stated that [J obtained its data via J, whereas 
the Commissioner’s investigation into i found that it obtained data 
via === In any event, the Commissioner notes from the 
‘due diligence’ form which EBAG provided in relation toi that its 
‘example of website used to get opt in data’ cites 
ee 2: a source website and so is satisfied 
that the data is likely to have originated from the same sources as 
disclosed to the Commissioner by J. 


54. For consent to be valid it is required to be “freely given”, by which it 
follows that if consent to marketing is a condition of subscribing to a 
service, the organisation will have to demonstrate how the consent can 


be said to have been given freely. 


? Although it is understood that data obtained via this website was not used vy fi following the introduction of 
Regulation 21B PECR. 
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Consent is also required to be “specific” as to the type of marketing 


communication to be received, and the organisation, or specific type of 


organisation, that will be sending it. 


Consent will not be “informed” if individuals do not understand what 
they are consenting to. Organisations should therefore always ensure 
that the language used is clear, easy to understand, and not hidden 
away in a privacy policy or small print. Consent will not be valid if 
individuals are asked to agree to receive marketing from “similar 


WN "n 


organisations”, “partners”, “selected third parties” or other similar 


generic description. 


In this instance, EBAG instigated direct marketing calls to individuals 


who had provided their details via six competition/offer websites. 


EBAG has not provided evidence of specific consent for the calls that it 
instigated. The Commissioner has however sought to review the sites 
from which consent would have been obtained by its IARs. She takes 


the view that the point at which consent was obtained via 


N -< 
m eee it is clear that there is an apparent option for 


individuals to select the means by which they may wish to receive 


direct marketing. However, before being able to proceed, individuals 
are required to agree to the relevant website’s privacy policy, with the 
privacy policies themselves dictating the way marketing will be sent, 
apparently regardless of any preferences selected by the individual. 
Furthermore, individuals are denied the ability to select which of the 
listed sectors or organisations they may wish to receive that marketing 
from, which implies that the individual must agree to receive marketing 
from all. In this way, any consent relied upon by EBAG for the calls 
made by il cannot be said to have been appropriately specific or freely 


given. 
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Looking at the competitions websites used by [i it is apparent that 
an individual cannot enter a competition without providing consent to 
marketing. There is no way for an individual to freely consent to 
receive a specific method of marketing or to receive marketing from 
individual third parties as listed. Accordingly, EBAG would be unable to 


evidence valid consent for the calls made to these individuals by its IAR 


in relation to pension schemes. 


The Commissioner has established that between 11 January 2019 and 
30 April 2019 there were 106,987 connected calls made by ii” at the 
instigation of EBAG; with a further 16 calls being made (capable of 
being evidenced by complaints) between 2 February 2019 and 30 
September 2019 bya: the instigation of EBAG. 


The Commissioner is therefore satisfied that, between 11 January 2019 
and 30 September 2019, EBAG instigated the use of a public electronic 
communications service for the purpose of making 107,003 unsolicited 
calls for the purposes of direct marketing in relation to occupational 
pension schemes or personal pension schemes contrary to regulation 
21B of PECR. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 
Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 

above was serious. This is because between 11 January 2019 and 30 

September 2019 there were 107,003 unsolicited direct marketing calls 

made to subscribers in relation to occupational pension schemes or 

personal pension schemes, with those calls being instigated by EBAG 
15 


64. 


65. 


66. 


67. 


68. 


Information Commissioner's Office 


when it did not hold valid consent, or have an existing customer 


relationship with the subscribers. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A (1) DPA is met. 


Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 
above was deliberate. The Commissioner does not consider that EBAG 


deliberately set out to contravene PECR in this instance. 


The Commissioner has gone on to consider whether the contravention 
identified above was negligent. This consideration comprises two 


elements: 


Firstly, the Commissioner has considered whether EBAG knew or ought 
reasonably to have known that there was a risk that these 
contraventions would occur. She is satisfied that this condition is met, 
not least because the issue of unsolicited calls in relation to 
occupational pension schemes or personal pension schemes has been 
widely publicised by the media as being a problem, so much so that it 
prompted recent legislative change to prohibit the making of such calls 
unless certain conditions are met. It is reasonable to suppose that any 
organisation wishing to carry out such activities should, and indeed 


must, be aware of its responsibilities in this area. 


The Commissioner has published detailed guidance on her website for 
those carrying out direct marketing calls for the purposes of pension 
schemes, explaining the strict criteria under which such calls can be 


made. This guidance explains such calls must not be made relation to 
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pension schemes unless the person calling is a trustee or manager of a 
pension scheme or a is firm authorised by the Financial Conduct 


Authority, and the individual being called has specifically consented to 


such calls or has a defined existing client relationship. 


Whilst the Commissioner accepts that EBAG was itself authorised with 
the Financial Conduct Authority, and could accordingly satisfy the 
requirement of Regulation 21B(2)(a) and/or 21B(3)(a), neither EBAG 
nor its IARs held valid consent for the calls made; nor did they have an 
existing client relationship with the individuals being called. It would 
be reasonable to expect an organisation to be aware of the risks of 
engaging in such direct marketing calls when it could not satisfy these 


requirements. 


Secondly, the Commissioner has gone on to consider whether EBAG 
failed to take reasonable steps to prevent the contraventions. Again, 


she is satisfied that this condition is met. 


Reasonable steps in these circumstances may have included 
completing sufficient due diligence so that it could demonstrate valid 
consent for the calls being made to individuals at its instigation, and 
ensuring appropriate records of that consent so as to be able to 
demonstrate it if required. It would not be appropriate for EBAG to 
seek to deflect the responsibility for such checks on to the third parties 


when the legal obligation falls on itself to hold valid consent. 


Given the volume of calls made in contravention of Regulation 21B 


PECR, it is clear that EBAG failed to take adequate reasonable steps. 


The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met 
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The Commissioner's decision to issue a monetar enalt 


The Commissioner has taken into account the following aggravating 


features of this case: 


EBAG had sought to generate leads for the purpose of financial gain, 


with its actions ultimately being in contravention of PECR. 


The ICO produces clear guidance via its website on the rules of direct 
marketing. In addition it also operates a helpline should organisations 
be unsure and require further clarification. The Commissioner also 
notes the significant amount of advice circulated by the FCA on the 
implementation of regulations covering pension cold-calling ban. As 
EBAG are an ‘Authorised Person’ the organisation should have been 


fully aware of their legal obligations. 


The Commissioner takes the view that EBAG instigated the marketing 
campaign and employed the services of IARs whilst knowing the cold- 
calling ban was in place, as a way to circumnavigate PECR. Neither ii 
nori would have made the calls if EBAG had not initiated them and 


offered financial inducements for generating leads. 


The Commissioner has taken into account the following mitigating 


feature of this case: 


EBAG sought advice from a third-party compliance consultancy when 
engaging its IARs with a view to ensuring compliance with PECR, 


however that advice was insufficient. 


For the reasons explained above, the Commissioner is satisfied that the 


conditions from section 55A (1) DPA have been met in this case. She is 
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also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out her preliminary thinking. In reaching her final 
view, the Commissioner has taken into account the representations 

made by EBAG on this matter. 


The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 


The Commissioner has considered whether, in the circumstances, she 


should exercise her discretion so as to issue a monetary penalty. 


The Commissioner has considered the likely impact of a monetary 
penalty on EBAG. She has decided on the information that is available 
to her that EBAG has access to sufficient financial resources to pay the 


proposed monetary penalty without causing undue financial hardship. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The making of 
unsolicited direct marketing calls, particularly in relation to pension 
schemes, is a matter of significant public and parliamentary concern. A 
monetary penalty in this case should act as a general encouragement 
towards compliance with the law, or at least as a deterrent against 
non-compliance, on the part of all persons running businesses currently 
engaging in these practices. This is an opportunity to reinforce the 
need for businesses to ensure that they meet the strict criteria to 
engage in such activities and are only telephoning consumers who 


specifically consent to receive these calls. 
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For these reasons, the Commissioner has decided to issue a monetary 


penalty in this case. 


The amount of the penalty 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £140,000 (one hundred and forty 
thousand pounds) is reasonable and proportionate given the 
particular facts of the case and the underlying objective in imposing the 


penalty. 
Conclusion 


The monetary penalty must be paid to the Commissioner’s office by 
BACS transfer or cheque by 5 January 2022 at the latest. The 
monetary penalty is not kept by the Commissioner but will be paid into 
the Consolidated Fund which is the Government’s general bank account 
at the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
4 January 2022 the Commissioner will reduce the monetary penalty 
by 20% to £112,000 (one hundred and twelve thousand 
pounds). However, you should be aware that the early payment 


discount is not available if you decide to exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 


(a) the imposition of the monetary penalty 


and/or; 
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(b) the amount of the penalty specified in the monetary penalty 


notice. 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 


unless: 


e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 


penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 


variation of it has expired. 


In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as 
an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 
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Dated the 29t" day of November 2021. 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 55B(5) of the Data Protection Act 1998 gives any person 
upon whom a monetary penalty notice has been served a right of 
appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) 


against the notice. 
2. If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of 
discretion by the Commissioner, that she ought to have exercised 


her discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the 


Tribunal at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LEi 8DJ 
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Information Commissioner’s Office 


Telephone: 0203 936 8963 
Email: grc@justice.gov.uk 


a) The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 

b) If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 
rule. 


The notice of appeal should state: - 


a) your name and address/name and address of your 


representative (if any); 


b) an address where documents may be sent or delivered to 


you; 

c) the name and address of the Information Commissioner; 
d) details of the decision to which the proceedings relate; 
e) the result that you are seeking; 

f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 


h) if you have exceeded the time limit mentioned above the 


notice of appeal must include a request for an extension of time 
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and the reason why the notice of appeal was not provided in 


time. 


5; Before deciding whether or not to appeal you may wish to consult 
your solicitor or another adviser. At the hearing of an appeal a party 
may conduct his case himself or may be represented by any person 


whom he may appoint for that purpose. 


6. The statutory provisions concerning appeals to the First-tier 
Tribunal (Information Rights) are contained in section 55B(5) of, and 
Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure 
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009 
(Statutory Instrument 2009 No. 1976 (L.20)). 
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